Skip to main content
U.S. flag

An official website of the United States government

Dot gov

The .gov means it’s official.
Federal government websites often end in .gov or .mil. Before sharing sensitive information, make sure you’re on a federal government site.

Https

The site is secure.
The https:// ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely.

Automatic Recognition of Advanced Persistent Threat Tactics for Enterprise Security

Published

Author(s)

Qingtian Zou, Anoop Singhal, Xiaoyan Sun, Peng Liu

Abstract

Advanced Persistent Threats (APT) has become the concern of many enterprise networks. APT can remain undetected for a long time span and lead to undesirable consequences such as stealing of sensitive data, broken workflow, and so on. To achieve the attack goal, attackers usually leverage specific tactics that utilize a variety of techniques. This paper explores the recognition of APT tactics through synthesized analysis and correlation of data from various sources. We propose a framework for detecting the APT tactics and discuss the application of machine learning techniques in this problem. Our framework can be used by the security analysts for effective detection of APT attacks. The evaluation of our approach shows that it can detect APT tactics with high accuracy and low false positive rate. Therefore, it can be used for tactic-centric APT detection and effective implementation of cyber security response operations.
Proceedings Title
The 10th ACM Conference on Data and Application Security and Privacy
Conference Dates
March 16-18, 2020
Conference Location
New Orleans, LA
Conference Title
6th ACM International Workshop on Security and Privacy Analytics 2020

Keywords

Advanced Persistent Threat, Attack Tactics, Machine learning
Created March 16, 2020, Updated May 12, 2020